WSO2 Identity Server

Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and unauthenticated requests.

Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification

Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification

Reflected Cross-Site Scripting (XSS) in Authentication Endpoint of Multiple WSO2 Products Due to Missing Output Encoding

Reflected Cross-Site Scripting (XSS) in WSO2 Identity Server Account Registration Flow

Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites

Open Redirection in Multiple WSO2 Products via Multi-Option Authentication Endpoint

Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products

Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding

Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity Server

Improper Token Invalidation in WSO2 Identity Server Allows Access After Account Lock

SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products

Improper Authentication in WSO2 Identity Server 7.0.0 Allows Bypass of App-Native Authentication

Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure

Incorrect Authorization in Multiple WSO2 Products Allows API Access via Refresh Token

WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers.

An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. Reflected XSS exists in the carbon part of the product.

Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw

An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console Policy Administration user interface.

An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console Basic Policy Editor user Interface.

Reflected Cross-Site Scripting (XSS) in WSO2 Identity Server 7.0.0 Sub-Organization Login Flow

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure

Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation

Username Enumeration in Multiple WSO2 Products with Multi-Attribute Login Enabled

Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery

Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation

Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access

WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential stored Cross-Site Scripting (XSS) vulnerability in mediaType has been identified in the registry UI.

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential stored Cross-Site Scripting (XSS) vulnerability in roleToAuthorize has been identified in the registry UI.

Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.

Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products

Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup

Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure

Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]

Content Spoofing in Multiple WSO2 Products via Error Message Injection

Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files

Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor

Improper Access Control via Secret Type Management API in WSO2 Identity Server